PT-2026-81129

CVE-2026-56702

Published

2026-07-09

Updated

2026-08-25

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 5.4.3

Description The AdminerFileUpload plugin allows authenticated users to upload PHP files due to a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in path and execute arbitrary code as the web-server user when uploadPath is web-served.

Recommendations Update to version 5.4.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Riodrwn

Vendors

Affected products

Weakness enumeration

CWE-434: Unrestricted Upload of File with Dangerous Type

Related identifiers